S/MIME (for Secure MIME, or Secure Multipurpose Mail Extension) is a security process used for e-mail exchanges that makes it possible to guarantee the confidentiality and non-repudiation of electronic messages.
S/MIME is based on the MIME standard, the goal of which is to let users attach files other than
ASCII text files to electronic messages. The MIME standard therefore makes it possible to attach
all types of files to e-mails.
S/MIME was originally developed by the company RSA Data Security. Ratified in July 1999 by the
IETF, S/MIME has become a standard, whose specifications are contained in RFCs 2630 to 2633.
How S/MIME works
The S/MIME standard is based on the principle of public-key encryption. S/MIME therefore makes
it possible to encrypt the content of messages but does not encrypt the communication.
The various sections of an electronic message, encoded according to the MIME standard, are
each encrypted using a session key.
The session key is inserted in each section's header, and is encrypted using the recipient's public
key. Only the recipient can open the message's body, using his private key, which guarantees the
confidentiality and integrity of the received message.
In addition, the message's signature is encrypted with the sender's private key. Anyone
intercepting the communication can read the content of the message's signature, but this ensures
the recipient of the sender's identity, since only the sender is capable of encrypting a message
(with his private key) that can be decrypted with his public key.
Reference(s) used for this question:
http://en.kioskea.net/contents/139-cryptography-s-mime
RFC 2630: Cryptographic Message Syntax;
OPPLIGER, Rolf, Secure Messaging with PGP and S/MIME, 2000, Artech House;
HARRIS, Shon, All-In-One CISSP Certification Exam Guide, 2001, McGraw-Hill/Osborne, page
570;
SMITH, Richard E., Internet Cryptography, 1997, Addison-Wesley Pub Co.

Output controls are used for two things: for verifying the integrity and protecting the
confidentiality of an output. These are examples of proper output controls.
Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten
Domains of Computer Security, John Wiley & Sons, 2001, Chapter 6: Operations Security (page
218).

Security testing makes sure the modified or new system includes appropriate
access controls and does not introduce any security holes that might compromise other systems.
Recovery testing checks the system's ability to recover after a software or hardware failure.
Stress/volume testing involves testing an application with large quantities of data in order to
evaluate performance during peak hours.
Interface testing evaluates the connection of two or more components that pass information from
one area to another.
Source: Information Systems Audit and Control Association, Certified Information Systems Auditor
2002 review manual, Chapter 6: Business Application System Development, Acquisition,
Implementation and Maintenance (page 300).